In GitHub Actions, how can I run a terraform plan when a PR is opened, and run an apply after the PR is merged?

I'm on GitHub Enterprise 3.6.2

I'm trying to design the following Workflow in GitHub Actions:

• A PR is opened with changes to the Terraform Codebase
• Lint and Terraform Plan actions are triggered
• Once the PR is approved and merged, a Terraform Apply is triggered

What I have currently designed, is a "plan" workflow that triggers on a PR, and an "apply" workflow that triggers when a PR is merged. The problem comes from trying to take the plan's output file, and feeding it to the apply step. Thus far, I've been unable to find a reasonable way to make this work.

Ideally, I could just include both steps as jobs within a single workflow run, but it doesn't seem to be possible to pause the workflow for a PR review, and only continue once the PR is merged.

Thought's on how I might be able to make this work?

You would ideally re-run the plan and apply on merge to main, since there could easily be other merges and your "PR plan" would therefore be stale.

Otherwise, upload the plan output to storage (e.g. S3), ordered by PR name/date, then download latest plan on merges before applying.